summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* trusts: Do not create ranges for subdomains in case of POSIX trustTomas Babej2013-10-141-11/+39
| | | | | | For the AD trusts where the ID range for the root level domain is of ipa-ad-trust-posix type, do not create a separate ranges for the subdomains, since POSIX attributes provide global mapping.
* Winsync re-initialize should not run memberOf fixup taskMartin Kosek2013-10-111-5/+6
| | | | | | | Change re-initialize command to consider memberOf fixup task only for non-winsync replication agreements. https://fedorahosted.org/freeipa/ticket/3854
* Use consistent realm name in cainstance and dsinstanceMartin Kosek2013-10-112-19/+18
| | | | | | | | The installers used custom self.realm_name instead of standard self.realm defined in Service class. It caused crashes in some cases when Service class methods expected the self.realm to be filled. https://fedorahosted.org/freeipa/ticket/3854
* PKI installation on replica failing due to missing proxy confMartin Kosek2013-10-112-2/+5
| | | | | | | | Proxy configuration was not detected correctly. Both ipa-pki-proxy.conf and ipa.conf need to be in place and httpd restarted to be able to check it's status. https://fedorahosted.org/freeipa/ticket/3964
* Remove --no-serial-autoincrementMartin Kosek2013-10-116-22/+3
| | | | | | | | Deprecate this option and do not offer it in installation tools. Without this option enabled, advanced DNS features like DNSSEC would not work. https://fedorahosted.org/freeipa/ticket/3962
* Add tests for the IntEnum classPetr Viktorin2013-10-091-54/+100
| | | | | The StrEnum and Int tests are restructured to allow sharing the tests. Individual *Enum tests are separated into methods.
* Add IntEnum parameter to ipalibNathaniel McCallum2013-10-092-25/+43
|
* Allow multiple types in Param type validationNathaniel McCallum2013-10-092-36/+20
| | | | | Int already needed to take both int and long. This makes the functionality available for all Param classes.
* Add optional_create flagNathaniel McCallum2013-10-082-5/+12
|
* test_ipalib.test_crud: Don't use a string in takes_optionsPetr Viktorin2013-10-081-1/+1
| | | | Options should be Param subclasses.
* Don't special case the Password class in Param.__init__()Nathaniel McCallum2013-10-081-11/+6
|
* Use the right attribute with ipapwd_entry_checks for MagicRegenSumit Bose2013-10-081-1/+2
| | | | | | | | | | | | | There is a special mode to set the ipaNTHash attribute if a RC4 Kerberos key is available for the corresponding user. This is typically triggered by samba via the ipa_sam passdb plugin. The principal used by samba to connect to the IPA directory server has the right to modify ipaNTHash but no other password attribute. This means that the current check on the userPassword attribute is too strict for this case and leads to a failure of the whole operation. With this patch the access right on ipaNTHash are checked if no other password operations are requested.
* Document no_search in Param flagsNathaniel McCallum2013-10-071-1/+3
|
* Do not allow '%' in DM passwordMartin Kosek2013-10-041-1/+1
| | | | | | | Having '%' in DM password causes pkispawn to crash. Do not allow users to enter it until pkispawn is fixed. https://bugzilla.redhat.com/show_bug.cgi?id=953488
* ipapython.nsslib: Name arguments to NSPRErrorPetr Viktorin2013-10-041-5/+7
| | | | | Previously NSPRError was given arguments in the wrong order. Fix this by naming the arguments.
* Do not fail upgrade if the global anonymous read ACI is not foundPetr Viktorin2013-10-041-2/+6
| | | | | | This helps forward compatibility: the anon ACI is scheduled for removal. https://fedorahosted.org/freeipa/ticket/3956
* ipa-client-install: Verify RPC connection with a pingPetr Viktorin2013-10-041-0/+9
| | | | | | | | | With old servers, it is possible that xmlclient.connect() succeeds but commands fail with a Kerberos error. Verify that commands succeed by sending a ping after connecting. Follow-up to: https://fedorahosted.org/freeipa/ticket/3931
* ipa-client-install: Use direct RPC instead of api.CommandPetr Viktorin2013-10-041-3/+13
| | | | | | | | | | | | To make sure the installation works with older servers, use XML-RPC directly, with a version set explicitly so the request is not rejected. RPC was chosen over ldapmodify, because going through the API allows the server to process the request properly, or even cleanly reject it if there are incompatible changes in future versions. https://fedorahosted.org/freeipa/ticket/3931
* Update translations from TransifexPetr Viktorin2013-10-0417-516/+2596
|
* Remove faulty DNS memberOf TaskMartin Kosek2013-10-041-9/+2
| | | | | | | | | | | This task was added with a DN colliding with privilege update memberOf task being run later and caused this task to be ineffective and thus miss some privilege membership, like "SELinux User Map Administrators" DNS update plugin do not need to run any task at all as privileges will be updated later in scope of 55-pbacmemberof.update https://fedorahosted.org/freeipa/ticket/3877
* Add tests for installing with empty PKCS#12 passwordPetr Viktorin2013-10-041-14/+87
|
* Allow PKCS#12 files with empty password in install tools.Jan Cholasta2013-10-043-11/+11
| | | | https://fedorahosted.org/freeipa/ticket/3897
* Read passwords from stdin when importing PKCS#12 files with pk12util.Jan Cholasta2013-10-046-35/+42
| | | | | | | This works around pk12util refusing to use empty password files, which prevents the use of PKCS#12 files with empty password. https://fedorahosted.org/freeipa/ticket/3897
* Require new SSSD to pull required AD subdomain fixesMartin Kosek2013-10-041-1/+1
|
* ipa-kdb: Handle parent-child relationship for subdomainsAlexander Bokovoy2013-10-042-10/+105
| | | | | | | | | | | | | | | | | When MS-PAC information is re-initialized, record also parent-child relationship between trust root level domain and its subdomains. Use parent incoming SID black list to check if child domain is not allowed to access IPA realm. We also should really use 'cn' of the entry as domain name. ipaNTTrustPartner has different meaning on wire, it is an index pointing to the parent domain of the domain and will be 0 for top level domains or disjoint subdomains of the trust. Finally, trustdomain-enable and trustdomain-disable commands should force MS-PAC cache re-initalization in case of black list change. Trigger that by asking for cross-realm TGT for HTTP service.
* KDC: implement transition check for trusted domainsAlexander Bokovoy2013-10-043-2/+68
| | | | | | | | | | | | When client principal requests for a ticket for a server principal and we have to perform transition, check that all three belong to either our domain or the domains we trust through forest trusts. In case all three realms (client, transition, and server) match trusted domains and our domain, issue permission to transition from client realm to server realm. Part of https://fedorahosted.org/freeipa/ticket/3909
* ipasam: for subdomains pick up defaults for missing valuesAlexander Bokovoy2013-10-041-0/+12
| | | | | | We don't store trust type, attributes, and direction for subdomains of the existing trust. Since trust is always forest level, these parameters can be added as defaults when they are missing.
* trust: integrate subdomains support into trust-addAlexander Bokovoy2013-10-042-36/+67
|
* ipaserver/dcerpc: remove use of trust account authenticationAlexander Bokovoy2013-10-042-71/+6
| | | | | | | | Since FreeIPA KDC supports adding MS-PAC to HTTP/ipa.server principal, it is possible to use it when talking to the trusted AD DC. Remove support for authenticating as trust account because it should not really be used other than within Samba.
* frontend: report arguments errors with better detailAlexander Bokovoy2013-10-042-2/+3
| | | | | When reporting argument errors, show also a context -- what is processed, what is the name of the command.
* trusts: support subdomains in a forestAlexander Bokovoy2013-10-043-51/+420
| | | | | | | | | | | | | | | | | | | Add IPA CLI to manage trust domains. ipa trust-fetch-domains <trust> -- fetch list of subdomains from AD side and add new ones to IPA ipa trustdomain-find <trust> -- show all available domains ipa trustdomain-del <trust> <domain> -- remove domain from IPA view about <trust> ipa trustdomain-enable <trust> <domain> -- allow users from trusted domain to access resources in IPA ipa trustdomain-disable <trust> <domain> -- disable access to resources in IPA from trusted domain By default all discovered trust domains are allowed to access IPA resources IPA KDC needs also information for authentication paths to subdomains in case they are not hierarchical under AD forest trust root. This information is managed via capaths section in krb5.conf. SSSD should be able to generate it once ticket https://fedorahosted.org/sssd/ticket/2093 is resolved. part of https://fedorahosted.org/freeipa/ticket/3909
* ipaserver/dcerpc.py: populate forest trust information using realmdomainsAlexander Bokovoy2013-10-041-18/+95
| | | | | | | | Use realmdomains information to prepopulate forest trust info. As result, all additional domains should now be enabled from the beginning, unless they really conflict with existing DNS domains on AD side. https://fedorahosted.org/freeipa/ticket/3919
* ipatests.test_cmdline.test_help: Re-raise unexpected exceptions on failurePetr Viktorin2013-10-031-1/+2
| | | | | | If an exception is expected, but another one is raised, the CLITestContext raised a generic AssertionError. Pass through the original exception instead
* ipatests.test_integration.host: Add logging to ldap_connect()Petr Vobornik2013-10-031-2/+4
|
* ipatests.beakerlib_plugin: Add argument of generated tests to test captionsPetr Viktorin2013-10-032-1/+9
| | | | | | | | | | | To differentiate between individual tests in BeakerLib output, the argument needs to be added to the test name. Since Nose doesn't provide a way to get the argument in a plugin, a `test_argument` attribute must be added to the test function to support this, simlarly to how `description` is used to set individual "docstrings". Add test_argument to the generated tests in the CA-less suite.
* ipatests.order_plugin: Exclude test generators from the orderPetr Viktorin2013-10-031-1/+14
| | | | | | | Ordered test generators were not announced in plugin hooks, so e.g. the Beakerlib or collect plugin did not announce them. Exclude test generators from ordering.
* ipatests.beakerlib_plugin: Warn instead of failing when some logs are missingPetr Viktorin2013-10-031-2/+1
|
* ipatests.test_integration.test_caless: Fix mkdir_recursive callPetr Viktorin2013-10-031-1/+1
|
* test_integration: Add OpenSSHTransport, used if paramiko is not availablePetr Viktorin2013-10-032-2/+140
| | | | | | | | | | This adds a transport that uses /usr/bin/ssh calls to communicate with remote hosts. This transport is a bit slower and buffers output more than paramiko, so it is only used if paramiko is not available, or forced with an environment variable. https://fedorahosted.org/freeipa/ticket/3890
* test_integration.host: Move transport-related functionality to a new modulePetr Viktorin2013-10-034-214/+371
| | | | | | | | | | | | | | | This will make it possible to use a different mechanism for cases like - Paramiko is not available - Hosts without SSH servers (e.g. Windows) Add BaseHost, Transport & Command base classes that define the interface and common functionality, and Host, ParamikoTransport & SSHCommand with specific details. The {get,put}_file_contents methods are left on Host for convenience; all other Transport methods must be now accessed through the transport. Part of the work for https://fedorahosted.org/freeipa/ticket/3890
* Do not set DNS discovery domain in server modeMartin Kosek2013-10-031-1/+2
| | | | | | | In server mode, the discovery domain should be left unset in all cases as the DNS discovery is only driven by the AD domains. https://fedorahosted.org/freeipa/ticket/3947
* Use FQDN when creating MSDCS SRV recordsMartin Kosek2013-10-031-4/+11
| | | | | | | When IPA server hostname is outside of default DNS domain, instead of relative domain name, FQDN should be used. https://fedorahosted.org/freeipa/ticket/3908
* Warn user about realm-domain mismatch in install scriptsTomas Babej2013-10-034-1/+31
| | | | | | | | | | | | | | If the IPA server is setup with non-matching domain and realm names, it will not be able to estabilish trust with the Active Directory. Adds warnings to the ipa-server-install and warning to the ipa-adtrust-install (which has to be confirmed). Man pages for the ipa-server-install and ipa-adtrust-install were updated with the relevant notes. https://fedorahosted.org/freeipa/ticket/3924
* Do not add trust to AD in case of IPA realm-domain mismatchTomas Babej2013-10-031-0/+13
| | | | | | | | Make sure that trust-add command fails when admin attempts to add an Active Directory trust when the realm name and the domain name of the IPA server do not match. https://fedorahosted.org/freeipa/ticket/3923
* Fix enablement of automount map type selectorPetr Vobornik2013-10-032-1/+37
| | | | | | Map type radio used old way of defining that its value should not be used in add command. Recent patch related to 'enable' attribute hardened/fixed the behavior of radio widgets so they are disabled in UI as well when enabled==false. Automount did not reflect this change. https://fedorahosted.org/freeipa/ticket/3954
* Use correct super-calls in get_args() methodsPetr Viktorin2013-10-022-24/+21
| | | | | | | | | | The get_args methods in ipalib.crud and ipalib.plugins.baseldap used super() calls that skipped some of the classes in the inheritance chain, and contained code that reimplemented some of the skipped functionality. This made it difficult to customize the get_args behavior. Use proper super() calls.
* Ensure credentials structure is initializedNathaniel McCallum2013-10-021-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3953
* CLDAP: do not read IPA domain from hostnameSumit Bose2013-09-271-47/+25
| | | | | | | | | | | | Currently the CLDAP plugin determines the IPA domain name by reading the current host name and splitting of the domain part. But since an IPA server does not have to be in a DNS domain which has the same name as the IPA domain this may fail. The domain name was used to search the ipaNTDomainAttrs object, but since this object is unique in the tree it is sufficient to use the objectclass in the search filter. Now the IPA domain can be read from the ipaNTDomainAttrs object as well. Fixes https://fedorahosted.org/freeipa/ticket/3941
* Allow edit of ipakrbokasdelegate in Web UI when attrlevelrights are unknownPetr Vobornik2013-09-262-3/+5
| | | | | | | | Old host entries are missing object class with krbticketflags attribute. Therefore UI does not receive attrlevelrights for it. This OC is added when ipakrbokasdelegate is set. This patch adds the usual hack for such cases. https://fedorahosted.org/freeipa/ticket/3940
* Raise an error when updating CIDict with duplicate keysPetr Viktorin2013-09-252-3/+34
| | | | | | | | | Updating a CIDict with data like {'A': 1, 'a': 2} would lead to data loss since only one of the items would get to the CIDict. This can result in non-obvious bugs similar to this one in python-ldap: https://bugzilla.redhat.com/show_bug.cgi?id=1007820 Raise an error in this case; any resolution must be done by the caller.
generated by cgit (git 2.34.1) at 2024-11-16 04:26:20 +0000